CIS Oracle Linux 7 Workstation L1 v3.1.1

Audit Details

Name: CIS Oracle Linux 7 Workstation L1 v3.1.1

Updated: 9/19/2022

Authority: CIS

Plugin: Unix

Revision: 1.5

Estimated Item Count: 321

File Details

Filename: CIS_Oracle_Linux_7_v3.1.1_Workstation_L1.audit

Size: 1.04 MB

MD5: f9586b8b7f9be8085c12aa327933f45c
SHA256: ddc92ee9f26a6402fb390207e5d020194fdf227e3b76adb13371b516fac23312

Audit Items

DescriptionCategories
1.1.1.1 Ensure mounting of cramfs filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.1.1.1 Ensure mounting of cramfs filesystems is disabled - modprobe

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.1.1.3 Ensure mounting of udf filesystems is disabled - lsmod

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.1.1.3 Ensure mounting of udf filesystems is disabled - modprobe

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.1.2 Ensure /tmp is configured

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.1.3 Ensure noexec option set on /tmp partition

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.1.4 Ensure nodev option set on /tmp partition

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.1.5 Ensure nosuid option set on /tmp partition

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.6 Ensure /dev/shm is configured - fstab

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.6 Ensure /dev/shm is configured - mount

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.7 Ensure noexec option set on /dev/shm partition

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.8 Ensure nodev option set on /dev/shm partition

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.9 Ensure nosuid option set on /dev/shm partition

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.12 Ensure /var/tmp partition includes the noexec option

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.13 Ensure /var/tmp partition includes the nodev option

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.14 Ensure /var/tmp partition includes the nosuid option

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.18 Ensure /home partition includes the nodev option

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.19 Ensure removable media partitions include noexec option

ACCESS CONTROL, MEDIA PROTECTION

1.1.20 Ensure nodev option set on removable media partitions

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.21 Ensure nosuid option set on removable media partitions

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.1.22 Ensure sticky bit is set on all world-writable directories

ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION, SYSTEM AND SERVICES ACQUISITION

1.2.1 Ensure GPG keys are configured

RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

1.2.2 Ensure package manager repositories are configured

RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

1.2.3 Ensure gpgcheck is globally activated

RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

1.3.1 Ensure AIDE is installed

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

1.3.2 Ensure filesystem integrity is regularly checked - cron

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

1.3.2 Ensure filesystem integrity is regularly checked - systemctl is-enabled aidecheck.service

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

1.3.2 Ensure filesystem integrity is regularly checked - systemctl is-enabled aidecheck.timer

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

1.3.2 Ensure filesystem integrity is regularly checked - systemctl status aidecheck.timer

ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

1.4.1 Ensure bootloader password is set

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.4.2 Ensure permissions on bootloader config are configured - grub.cfg

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.4.2 Ensure permissions on bootloader config are configured - user.cfg

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.4.3 Ensure authentication required for single user mode - emergency.service

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.4.3 Ensure authentication required for single user mode - rescue.service

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.5.1 Ensure core dumps are restricted - limits.conf limits.d

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.5.1 Ensure core dumps are restricted - sysctl

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.5.1 Ensure core dumps are restricted - sysctl.conf sysctl.d

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.5.1 Ensure core dumps are restricted - systemd-coredump ProcessSizeMax

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.5.1 Ensure core dumps are restricted - systemd-coredump Storage

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.5.2 Ensure XD/NX support is enabled

SYSTEM AND INFORMATION INTEGRITY

1.5.3 Ensure address space layout randomization (ASLR) is enabled - sysctl

SYSTEM AND INFORMATION INTEGRITY

1.5.3 Ensure address space layout randomization (ASLR) is enabled - sysctl.conf sysctl.d

SYSTEM AND INFORMATION INTEGRITY

1.5.4 Ensure prelink is not installed

CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

1.6.1.1 Ensure SELinux is installed

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.2 Ensure SELinux is not disabled in bootloader configuration

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.3 Ensure SELinux policy is configured - /etc/selinux/config

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.3 Ensure SELinux policy is configured - sestatus

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.4 Ensure the SELinux mode is enforcing or permissive - /etc/selinux/config

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.4 Ensure the SELinux mode is enforcing or permissive - getenforce

ACCESS CONTROL, MEDIA PROTECTION

1.6.1.6 Ensure no unconfined services exist

ACCESS CONTROL, MEDIA PROTECTION